@attest-it/cli 0.9.0 → 0.9.1

package/dist/bin/attest-it.js

@@ -1,15 +1,15 @@
 #!/usr/bin/env node
-import { Command } from 'commander';
 import * as fs from 'fs';
-import { readFileSync } from 'fs';
+import { readFileSync, existsSync, realpathSync } from 'fs';
 import * as path from 'path';
 import { join, dirname } from 'path';
+import { spawn, spawnSync } from 'child_process';
 import { fileURLToPath } from 'url';
+import { Command } from 'commander';
 import { detectTheme } from 'chromaterm';
 import { input, select, confirm, checkbox } from '@inquirer/prompts';
 import { loadConfig, toAttestItConfig, readSealsSync, computeFingerprintSync, verifyGateSeal, verifyAllSeals, computeFingerprint, createAttestation, readAttestations, upsertAttestation, KeyProviderRegistry, getDefaultPrivateKeyPath, FilesystemKeyProvider, writeSignedAttestations, loadLocalConfigSync, getActiveIdentity, isAuthorizedSigner, createSeal, writeSealsSync, getGate, loadLocalConfig, OnePasswordKeyProvider, MacOSKeychainKeyProvider, YubiKeyProvider, getAttestItConfigDir, generateEd25519KeyPair, saveLocalConfig, savePublicKey, findConfigPath, loadPreferences, savePreferences, findAttestation, setAttestItHomeDir } from '@attest-it/core';
 import tabtab2 from '@pnpm/tabtab';
-import { spawn } from 'child_process';
 import * as os from 'os';
 import { parse } from 'shell-quote';
 import * as React7 from 'react';
@@ -18,6 +18,68 @@ import { jsx, jsxs, Fragment } from 'react/jsx-runtime';
 import { mkdir, writeFile, unlink, readFile } from 'fs/promises';
 import { stringify } from 'yaml';
 
+var __filename$1 = fileURLToPath(import.meta.url);
+function getExecutableExtensions() {
+  if (process.platform === "win32") {
+    return [".cmd", ".ps1", ""];
+  }
+  return [""];
+}
+function findLocalCli() {
+  let dir = process.cwd();
+  const extensions = getExecutableExtensions();
+  while (dir !== dirname(dir)) {
+    const binDir = join(dir, "node_modules", ".bin");
+    for (const ext of extensions) {
+      const localBin = join(binDir, `attest-it${ext}`);
+      if (existsSync(localBin)) {
+        return localBin;
+      }
+    }
+    dir = dirname(dir);
+  }
+  return null;
+}
+function getPackageRoot(filePath) {
+  const normalizedPath = filePath.replace(/\\/g, "/");
+  const regex = /(.*node_modules\/@attest-it\/cli)/;
+  const match = regex.exec(normalizedPath);
+  if (!match?.[1]) {
+    return null;
+  }
+  return filePath.slice(0, match[1].length);
+}
+function isSameAsCurrentCli(localCliPath) {
+  try {
+    const localReal = realpathSync(localCliPath);
+    const currentReal = realpathSync(__filename$1);
+    if (localReal === currentReal) {
+      return true;
+    }
+    const localPkgRoot = getPackageRoot(localReal);
+    const currentPkgRoot = getPackageRoot(currentReal);
+    return localPkgRoot !== null && localPkgRoot === currentPkgRoot;
+  } catch (err) {
+    console.warn(
+      `Warning: Could not resolve CLI paths for comparison: ${err instanceof Error ? err.message : String(err)}`
+    );
+    return false;
+  }
+}
+function tryDelegateToLocal() {
+  if (process.env.ATTEST_IT_SKIP_LOCAL_RESOLUTION === "1") {
+    return false;
+  }
+  const localCli = findLocalCli();
+  if (!localCli || isSameAsCurrentCli(localCli)) {
+    return false;
+  }
+  const result = spawnSync(localCli, process.argv.slice(2), {
+    stdio: "inherit",
+    env: { ...process.env, ATTEST_IT_SKIP_LOCAL_RESOLUTION: "1" }
+  });
+  process.exit(result.status ?? 1);
+}
 var globalOptions = {};
 var theme;
 async function initTheme() {
@@ -259,8 +321,8 @@ function getPackageVersion() {
   if (cachedVersion !== void 0) {
     return cachedVersion;
   }
-  const __filename = fileURLToPath(import.meta.url);
-  const __dirname = dirname(__filename);
+  const __filename2 = fileURLToPath(import.meta.url);
+  const __dirname = dirname(__filename2);
   const possiblePaths = [join(__dirname, "../package.json"), join(__dirname, "../../package.json")];
   for (const packageJsonPath of possiblePaths) {
     try {
@@ -286,8 +348,8 @@ var initCommand = new Command("init").description("Initialize attest-it configur
   await runInit(options);
 });
 function loadConfigTemplate() {
-  const __filename = fileURLToPath(import.meta.url);
-  const __dirname = dirname(__filename);
+  const __filename2 = fileURLToPath(import.meta.url);
+  const __dirname = dirname(__filename2);
   const possiblePaths = [
     join(__dirname, "../../templates/config.yaml"),
     join(__dirname, "../templates/config.yaml")
@@ -2273,10 +2335,19 @@ async function runCreate() {
       default: ""
     });
     info("Checking available key storage providers...");
+    info(
+      "You may see authentication prompts from 1Password, macOS Keychain, or other security tools."
+    );
     const opAvailable = await OnePasswordKeyProvider.isInstalled();
+    verbose(`  1Password CLI (op): ${opAvailable ? "found" : "not found"}`);
     const keychainAvailable = MacOSKeychainKeyProvider.isAvailable();
+    verbose(`  macOS Keychain: ${keychainAvailable ? "available" : "not available (not macOS)"}`);
     const yubikeyInstalled = await YubiKeyProvider.isInstalled();
+    verbose(`  YubiKey CLI (ykman): ${yubikeyInstalled ? "found" : "not found"}`);
     const yubikeyConnected = yubikeyInstalled ? await YubiKeyProvider.isConnected() : false;
+    if (yubikeyInstalled) {
+      verbose(`  YubiKey device: ${yubikeyConnected ? "connected" : "not connected"}`);
+    }
     const configDir = getAttestItConfigDir();
     const storageChoices = [
       { name: `File system (${join(configDir, "keys")})`, value: "file" }
@@ -2290,24 +2361,24 @@ async function runCreate() {
     if (yubikeyInstalled) {
       const yubikeyLabel = yubikeyConnected ? "YubiKey (encrypted with challenge-response)" : "YubiKey (not connected - insert YubiKey first)";
       storageChoices.push({ name: yubikeyLabel, value: "yubikey" });
+    } else {
+      storageChoices.push({
+        name: theme3.muted("YubiKey (install ykman CLI to enable)"),
+        value: "yubikey-disabled",
+        // @ts-expect-error -- @inquirer/prompts supports disabled property but types may not reflect it
+        disabled: true
+      });
     }
     const keyStorageType = await select({
       message: "Where should the private key be stored?",
       choices: storageChoices
     });
-    log("");
-    log("Generating Ed25519 keypair...");
-    const keyPair = generateEd25519KeyPair();
-    let privateKeyRef;
-    let keyStorageDescription;
+    let storageConfig;
     switch (keyStorageType) {
       case "file": {
         const keysDir = join(getAttestItConfigDir(), "keys");
-        await mkdir(keysDir, { recursive: true });
         const keyPath = join(keysDir, `${slug}.pem`);
-        await writeFile(keyPath, keyPair.privateKey, { mode: 384 });
-        privateKeyRef = { type: "file", path: keyPath };
-        keyStorageDescription = keyPath;
+        storageConfig = { type: "file", keyPath };
         break;
       }
       case "keychain": {
@@ -2315,6 +2386,9 @@ async function runCreate() {
           error("macOS Keychain is not available on this system");
           process.exit(ExitCode.CONFIG_ERROR);
         }
+        log("");
+        info("Accessing macOS Keychain to list available keychains...");
+        info("You may be prompted to allow access or enter your password.");
         const keychains = await MacOSKeychainKeyProvider.listKeychains();
         if (keychains.length === 0) {
           throw new Error("No keychains found on this system");
@@ -2350,38 +2424,15 @@ async function runCreate() {
             return true;
           }
         });
-        const { execFile } = await import('child_process');
-        const { promisify } = await import('util');
-        const execFileAsync = promisify(execFile);
-        const encodedKey = Buffer.from(keyPair.privateKey).toString("base64");
-        try {
-          const addArgs = [
-            "add-generic-password",
-            "-a",
-            "attest-it",
-            "-s",
-            keychainItemName,
-            "-w",
-            encodedKey,
-            "-U",
-            selectedKeychain.path
-          ];
-          await execFileAsync("security", addArgs);
-        } catch (err) {
-          throw new Error(
-            `Failed to store key in macOS Keychain: ${err instanceof Error ? err.message : String(err)}`
-          );
-        }
-        privateKeyRef = {
-          type: "keychain",
-          service: keychainItemName,
-          account: "attest-it",
-          keychain: selectedKeychain.path
-        };
-        keyStorageDescription = `macOS Keychain: ${selectedKeychain.name}/${keychainItemName}`;
+        storageConfig = { type: "keychain", selectedKeychain, keychainItemName };
         break;
       }
       case "1password": {
+        log("");
+        info("Accessing 1Password to list your accounts and vaults...");
+        info(
+          "You may see biometric prompts or be asked to unlock 1Password for each configured account."
+        );
         const accounts = await OnePasswordKeyProvider.listAccounts();
         if (accounts.length === 0) {
           throw new Error(
@@ -2402,7 +2453,7 @@ async function runCreate() {
                 "--format=json"
               ]);
               const details = JSON.parse(stdout);
-              const name2 = details !== null && typeof details === "object" && "name" in details && typeof details.name === "string" ? details.name : acc.url;
+              const name2 = details !== null && typeof details === "object" && "name" in details && typeof details.name === "string" ? details.name : "[Could not read account name]";
               return {
                 url: acc.url,
                 email: acc.email,
@@ -2412,7 +2463,7 @@ async function runCreate() {
               return {
                 url: acc.url,
                 email: acc.email,
-                name: acc.url
+                name: "[Could not read account name]"
               };
             }
           })
@@ -2454,43 +2505,21 @@ async function runCreate() {
             return true;
           }
         });
-        const { tmpdir } = await import('os');
-        const tempDir = join(tmpdir(), `attest-it-${String(Date.now())}`);
-        await mkdir(tempDir, { recursive: true });
-        const tempPrivatePath = join(tempDir, "private.pem");
-        try {
-          await writeFile(tempPrivatePath, keyPair.privateKey, { mode: 384 });
-          const { execFile: execFile2 } = await import('child_process');
-          const { promisify: promisify2 } = await import('util');
-          const execFileAsync2 = promisify2(execFile2);
-          const opArgs = [
-            "document",
-            "create",
-            tempPrivatePath,
-            "--title",
-            item,
-            "--vault",
-            selectedVault
-          ];
-          if (selectedAccount) {
-            opArgs.push("--account", selectedAccount);
-          }
-          await execFileAsync2("op", opArgs);
-        } finally {
-          const { rm } = await import('fs/promises');
-          await rm(tempDir, { recursive: true, force: true }).catch(() => {
-          });
-        }
-        privateKeyRef = {
+        const selectedAccountDetails = accountDetails.find((acc) => acc.url === selectedAccount);
+        const accountDisplayName = selectedAccountDetails?.name ?? selectedAccount;
+        storageConfig = {
           type: "1password",
-          vault: selectedVault,
-          item,
-          ...selectedAccount && { account: selectedAccount }
+          selectedAccount,
+          accountDisplayName,
+          selectedVault,
+          item
         };
-        keyStorageDescription = `1Password (${selectedVault}/${item})`;
         break;
       }
       case "yubikey": {
+        log("");
+        info("Accessing YubiKey to detect connected devices...");
+        info("Your private key will be encrypted using HMAC challenge-response from the YubiKey.");
         if (!await YubiKeyProvider.isConnected()) {
           error("No YubiKey detected. Please insert your YubiKey and try again.");
           process.exit(ExitCode.CONFIG_ERROR);
@@ -2542,25 +2571,115 @@ async function runCreate() {
           }
         });
         const keysDir = join(getAttestItConfigDir(), "keys");
-        await mkdir(keysDir, { recursive: true });
         const encryptedKeyPath = join(keysDir, encryptedKeyName);
+        storageConfig = { type: "yubikey", selectedSerial, slot, encryptedKeyPath };
+        break;
+      }
+      default:
+        throw new Error(`Unknown key storage type: ${keyStorageType}`);
+    }
+    log("");
+    log("Generating Ed25519 keypair...");
+    const keyPair = generateEd25519KeyPair();
+    let privateKeyRef;
+    let keyStorageDescription;
+    switch (storageConfig.type) {
+      case "file": {
+        log("");
+        info("Creating private key file on disk...");
+        const keysDir = join(getAttestItConfigDir(), "keys");
+        await mkdir(keysDir, { recursive: true });
+        await writeFile(storageConfig.keyPath, keyPair.privateKey, { mode: 384 });
+        privateKeyRef = { type: "file", path: storageConfig.keyPath };
+        keyStorageDescription = storageConfig.keyPath;
+        break;
+      }
+      case "keychain": {
+        const { execFile } = await import('child_process');
+        const { promisify } = await import('util');
+        const execFileAsync = promisify(execFile);
+        const encodedKey = Buffer.from(keyPair.privateKey).toString("base64");
+        try {
+          const addArgs = [
+            "add-generic-password",
+            "-a",
+            "attest-it",
+            "-s",
+            storageConfig.keychainItemName,
+            "-w",
+            encodedKey,
+            "-U",
+            storageConfig.selectedKeychain.path
+          ];
+          await execFileAsync("security", addArgs);
+        } catch (err) {
+          throw new Error(
+            `Failed to store key in macOS Keychain: ${err instanceof Error ? err.message : String(err)}`
+          );
+        }
+        privateKeyRef = {
+          type: "keychain",
+          service: storageConfig.keychainItemName,
+          account: "attest-it",
+          keychain: storageConfig.selectedKeychain.path
+        };
+        keyStorageDescription = `macOS Keychain: ${storageConfig.selectedKeychain.name}/${storageConfig.keychainItemName}`;
+        break;
+      }
+      case "1password": {
+        const { tmpdir } = await import('os');
+        const tempDir = join(tmpdir(), `attest-it-${String(Date.now())}`);
+        await mkdir(tempDir, { recursive: true });
+        const tempPrivatePath = join(tempDir, "private.pem");
+        try {
+          await writeFile(tempPrivatePath, keyPair.privateKey, { mode: 384 });
+          const { execFile } = await import('child_process');
+          const { promisify } = await import('util');
+          const execFileAsync = promisify(execFile);
+          const opArgs = [
+            "document",
+            "create",
+            tempPrivatePath,
+            "--title",
+            storageConfig.item,
+            "--vault",
+            storageConfig.selectedVault,
+            "--account",
+            storageConfig.selectedAccount
+          ];
+          await execFileAsync("op", opArgs);
+        } finally {
+          const { rm } = await import('fs/promises');
+          await rm(tempDir, { recursive: true, force: true }).catch(() => {
+          });
+        }
+        privateKeyRef = {
+          type: "1password",
+          vault: storageConfig.selectedVault,
+          item: storageConfig.item,
+          account: storageConfig.selectedAccount
+        };
+        keyStorageDescription = `1Password (${storageConfig.accountDisplayName}/${storageConfig.selectedVault}/${storageConfig.item})`;
+        break;
+      }
+      case "yubikey": {
+        const keysDir = join(getAttestItConfigDir(), "keys");
+        await mkdir(keysDir, { recursive: true });
         const result = await YubiKeyProvider.encryptPrivateKey({
           privateKey: keyPair.privateKey,
-          encryptedKeyPath,
-          slot,
-          serial: selectedSerial
+          encryptedKeyPath: storageConfig.encryptedKeyPath,
+          slot: storageConfig.slot,
+          serial: storageConfig.selectedSerial
         });
         privateKeyRef = {
           type: "yubikey",
           encryptedKeyPath: result.encryptedKeyPath,
-          slot,
-          serial: selectedSerial
+          slot: storageConfig.slot,
+          serial: storageConfig.selectedSerial
         };
         keyStorageDescription = result.storageDescription;
         break;
       }
-      default:
-        throw new Error(`Unknown key storage type: ${keyStorageType}`);
     }
     const identity = {
       name,
@@ -3696,6 +3815,7 @@ async function run() {
 }
 
 // bin/attest-it.ts
+tryDelegateToLocal();
 void run();
 //# sourceMappingURL=attest-it.js.map
 //# sourceMappingURL=attest-it.js.map